Checklist · Privacy, Data Protection & Cyber
Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
Checklist for assessing a claim, or a threatened claim, under the statutory tort for serious invasions of privacy: limitation, exemptions, each element, defences, remedies and the damages cap, forum, evidence and AI-specific scenarios such as deepfakes.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked against the cited sources on 17 October 2026.
- Version
- 1
- Source
- Written for this library
When to use it
Use at first instruction for a plaintiff or a defendant, and again before advising on prospects. Schedule 2 commenced on 10 June 2025 and has no express transitional provision, so treat it as applying to invasions from that date. For earlier conduct, or as alternatives, consider breach of confidence, defamation, an APP complaint and surveillance laws.
How AI may be used
AI may help build a chronology and an elements table that sets each fact against the statutory elements, factors and defences with document references. The lawyer assesses seriousness, the public-interest balance and prospects.
AI may
- Build a chronology and an elements table in which each row cites the source document.
- Calculate candidate limitation dates under clause 14 for the lawyer to check.
- List possible defences and exemptions that the documents raise.
AI must not
- Must not decide whether the invasion was "serious" or how the public-interest balance falls.
- Must not process intimate images, health information or other sensitive material in a tool not approved for that data.
- Must not generate, enhance or reproduce intimate or deepfake images, even to test the evidence.
The lawyer checks
- Limitation dates are worked out from evidence of when the plaintiff became aware and when the invasion occurred.
- No Part 3 exemption applies to the defendant, or the risk is identified.
- The current damages cap is checked before advising on quantum.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Notifiable data breach statement to the OAIC: completion guide for the online form
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area